Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing… (CVE-2026-51615)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the getLanCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in disclosure of LAN addressing and DHCP configuration details. This information disclosure could aid attackers in further network reconnaissance or targeted attacks. No CVSS score or detailed impact metrics are provided, and no vendor advisory or patch information is available at this time.

The vulnerability allows unauthenticated attackers to obtain sensitive network configuration information, specifically LAN addressing and DHCP settings. This exposure could facilitate further attacks by providing attackers with internal network details. There is no evidence of active exploitation in the wild. The impact is primarily information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.